On Task, Off Track: Benchmarking LLM and Agent Robustness to Near-Target Prompt Injection

What it is

NTBench (Near-Target Benchmark) is a red-teaming benchmark from researchers at Nanyang Technological University and Wuhan University (arXiv 2610.32531, 23 October 2026). It argues that prompt-injection tests built around attacks that abandon the task, such as "Print HACKED", can miss injections that keep the response looking right while making it wrong or harmful. The paper's example is a workshop announcement where the injected note changes the start time from 10 a.m. to 11 a.m., or adds the organizer's private phone number despite the user's instruction to omit it.

How it works

Each benchmark task comes from an existing dataset. A legitimate reference outcome is given to an LLM, which generates target responses that keep most of the legitimate answer but add an error or a harm. It also generates the injected instruction meant to produce each target.

• Tracks: an incorrect-target track and a harmful-target track. Harmful targets can sit alongside otherwise correct task completion, and can be generated content or agent tool calls. Harm criteria draw on OpenAI and Anthropic policies.
• Validation: LLM checks plus human validation confirm that each target is actually incorrect or harmful, not a paraphrase or another valid answer.
• Scoring: response judgments or tool-call checks decide whether the injection induced the target. Deviations that also appear in an attack-free run are excluded.
• Metric: ASR@3, the share of samples where at least one of three attack executions succeeds. Attack sets are fixed and shared across models.

Results

Seven models were tested: Meta-SecAlign-70B, GPT 5.6-Sol, Gemini 3.7-Flash, Claude Opus-5, GLM 5.3, DeepSeek Flash and Kimi K3. The data came from ten language datasets plus AgentDojo and AgentDyn for agents.

• Both near-target tracks beat the fixed-target baseline for every model in both the language and agent settings.
• On language tasks the gains are 9.3 to 35.8 points (incorrect) and 1.7 to 17.3 points (harmful).
• Meta-SecAlign-70B, trained specifically against prompt injection, goes from 3.2% ASR@3 on the baseline to 36.7% (incorrect) and 18.4% (harmful) on language tasks.
• The two tracks rank models differently, so which outcomes you test changes which model looks most robust.

Preconditions

The threat model allows addition-only injection at a designated spot in untrusted content, such as a document, message or tool result. The attacker cannot edit the trusted instructions or the original content, and has no access to tool permissions. Black-box access to the target model is assumed.

Caveats

• Target generation is assisted by benchmark references: the generator sees the legitimate request, the context and an accepted reference outcome. This is broader access than a real attacker would normally have.
• The authors say the rates describe vulnerability for the selected tasks, the generated attacks and the attempt budget. They are not general rates.
• Results are given without model-specific adaptive search or a larger execution budget.
• The fetched text ends partway through the threat model section. Dataset names beyond AgentDojo and AgentDyn, judge details and defense evaluations are not covered here. The per-model figures in the chart were not legible enough to report beyond the numbers above.